{
  "label": "Re-checks the stated properties of the stated model with Z3 and binds them to the exact source and spec hashes. It does not prove the model matches the real code or that the spec is complete; read the spec.",
  "public_key_b64": "0fZr8ehMMWwWYkI8GFigYocNuXuHqFIbecxlcCkvUg0=",
  "records": [
    {
      "checks": [
        {
          "detail": "the proof is about exactly this source content",
          "id": "binding.source_hash",
          "ok": true
        },
        {
          "detail": "revision '3f9c2a1b7e'",
          "id": "binding.revision",
          "ok": true
        },
        {
          "detail": "the claim names exactly this specification",
          "id": "binding.spec_hash",
          "ok": true
        },
        {
          "detail": "checker 'z3' (this engine re-checks with z3)",
          "id": "toolchain.checker",
          "ok": true
        },
        {
          "detail": "subject 'copy_checked' must appear in the bound source",
          "id": "P1-copy_checked-in-bounds.subject_in_source",
          "ok": true
        },
        {
          "detail": "claimed 'proved'",
          "id": "P1-copy_checked-in-bounds.claim_stated",
          "ok": true
        },
        {
          "detail": "claimed proved; re-checked: PROVED",
          "id": "P1-copy_checked-in-bounds.reproved",
          "ok": true
        },
        {
          "detail": "the assumptions are satisfiable",
          "id": "P1-copy_checked-in-bounds.not_vacuous",
          "ok": true
        },
        {
          "detail": "subject 'copy_naive' must appear in the bound source",
          "id": "P2-copy_naive-in-bounds.subject_in_source",
          "ok": true
        },
        {
          "detail": "claimed 'refuted'",
          "id": "P2-copy_naive-in-bounds.claim_stated",
          "ok": true
        },
        {
          "detail": "claimed refuted; re-checked: REFUTED",
          "id": "P2-copy_naive-in-bounds.refutation_holds",
          "ok": true
        },
        {
          "detail": "the assumptions are satisfiable",
          "id": "P2-copy_naive-in-bounds.not_vacuous",
          "ok": true
        },
        {
          "detail": "subject 'is_admin_action_allowed' must appear in the bound source",
          "id": "P3-delete-needs-admin.subject_in_source",
          "ok": true
        },
        {
          "detail": "claimed 'proved'",
          "id": "P3-delete-needs-admin.claim_stated",
          "ok": true
        },
        {
          "detail": "claimed proved; re-checked: PROVED",
          "id": "P3-delete-needs-admin.reproved",
          "ok": true
        },
        {
          "detail": "the assumptions are satisfiable",
          "id": "P3-delete-needs-admin.not_vacuous",
          "ok": true
        },
        {
          "detail": "",
          "id": "claims.no_unknown_properties",
          "ok": true
        }
      ],
      "created_at": "2026-11-12T07:59:13Z",
      "engine": "a75-004/1.0.0",
      "extra": {
        "counterexamples": {
          "P2-copy_naive-in-bounds": "cap=0, len=2079944679, off=2215022617"
        },
        "properties": {
          "P1-copy_checked-in-bounds": "PROVED",
          "P2-copy_naive-in-bounds": "REFUTED",
          "P3-delete-needs-admin": "PROVED"
        },
        "toolchain": {
          "claimed": "4.13.0",
          "rechecked_with": "5.1.0"
        }
      },
      "failed": [],
      "label": "Re-checks the stated properties of the stated model with Z3 and binds them to the exact source and spec hashes. It does not prove the model matches the real code or that the spec is complete; read the spec.",
      "prev_record_hash": "5807c188c900bb057dae9c9ff1e94e1db2b75e32aa23d15cc851dfb2b25368e7",
      "public_key_b64": "0fZr8ehMMWwWYkI8GFigYocNuXuHqFIbecxlcCkvUg0=",
      "record_hash": "5103b44e07467664ed2086e59e47dc9ee281157d37a3c71caba0e7b405ad9b74",
      "schema": "cain42.a75.proof.record.v1",
      "signature_b64": "mv6dac+y5EpQ7uINc4BcgcZeonFiRAFES8UsNXBd3us8Mejqnw7G0aRTAt9WOzcJVsgjSbM0zNRgg/JLUpOvDw==",
      "sku": "CAIN-A75-004",
      "subject": {
        "claims": {
          "P1-copy_checked-in-bounds": "proved",
          "P2-copy_naive-in-bounds": "refuted",
          "P3-delete-needs-admin": "proved"
        },
        "schema": "cain42.a75.proof.claim.v1",
        "signer": "agent:prover-1",
        "source": {
          "content": "/* buffer.c -- copy len bytes from src at offset off into a buffer of capacity cap */\n#include <stdint.h>\n#include <string.h>\n\nint copy_checked(uint8_t *dst, uint32_t cap, const uint8_t *src, uint32_t off, uint32_t len) {\n    if (off > cap || len > cap - off) return -1;          /* no wraparound: cap - off cannot underflow */\n    memcpy(dst + off, src, len);\n    return 0;\n}\n\nint copy_naive(uint8_t *dst, uint32_t cap, const uint8_t *src, uint32_t off, uint32_t len) {\n    if (off + len > cap) return -1;                        /* BUG: off + len can wrap around 2^32 */\n    memcpy(dst + off, src, len);\n    return 0;\n}\n\nint is_admin_action_allowed(int role, int action) {      /* role 2 = admin, action 3 = delete */\n    return role == 2 || action != 3;\n}\n",
          "path": "buffer.c",
          "revision": "3f9c2a1b7e",
          "sha256": "a773688ca9c1680ebc89fef9810585ba2b439b5daf2da764edc0d8878dbdb209"
        },
        "spec": {
          "properties": [
            {
              "assumptions": [
                "(not (bvugt off cap))",
                "(not (bvugt len (bvsub cap off)))"
              ],
              "declarations": "(declare-const cap (_ BitVec 32)) (declare-const off (_ BitVec 32)) (declare-const len (_ BitVec 32))",
              "goal": "(bvule (bvadd ((_ zero_extend 33) off) ((_ zero_extend 33) len)) ((_ zero_extend 33) cap))",
              "id": "P1-copy_checked-in-bounds",
              "subject": "copy_checked",
              "text": "if copy_checked accepts (off, len), the write stays inside the buffer"
            },
            {
              "assumptions": [
                "(not (bvugt (bvadd off len) cap))"
              ],
              "declarations": "(declare-const cap (_ BitVec 32)) (declare-const off (_ BitVec 32)) (declare-const len (_ BitVec 32))",
              "goal": "(bvule (bvadd ((_ zero_extend 33) off) ((_ zero_extend 33) len)) ((_ zero_extend 33) cap))",
              "id": "P2-copy_naive-in-bounds",
              "subject": "copy_naive",
              "text": "if copy_naive accepts (off, len), the write stays inside the buffer"
            },
            {
              "assumptions": [
                "(or (= role 2) (not (= action 3)))",
                "(= action 3)"
              ],
              "declarations": "(declare-const role Int) (declare-const action Int)",
              "goal": "(= role 2)",
              "id": "P3-delete-needs-admin",
              "subject": "is_admin_action_allowed",
              "text": "a delete is only allowed for an admin"
            }
          ],
          "sha256": "33fd110fc3ef68571fe6ccc3ef8119f33dc96a4b77c74033efc3115d24ac4fd0"
        },
        "toolchain": {
          "checker": "z3",
          "version": "4.13.0"
        }
      },
      "subject_sha256": "2a434e3f1c3a2ceb77dd6ca176df6fe32fb8e7b54ff627b24bf0c7bb1ea1ac63",
      "verdict": "VERIFIED"
    }
  ],
  "run_hash": "13520512c7d50bb13e9e2672a57745661036fc9fb908a30b37d3df91e44204a1",
  "schema": "cain42.a75.proof.run.v1",
  "sku": "CAIN-A75-004",
  "verdict": "VERIFIED",
  "verdicts": [
    "VERIFIED"
  ]
}